Privacy notice

Who we are

Familiagram is run by Looney Devs Ltd, Mount Maunganui, New Zealand. We decide how Familiagram works and we are responsible for the personal data in it. Each family space is looked after by its admins: they decide who joins and what their tree holds, and we keep it safe for them.

What we keep

About you as a member: your name, your email, a scrambled form of your password (never the password itself), your age group, your language, the families you belong to and your role in each. When you join a family, you also get your own place in its tree.

About the people in a tree: what members choose to add — names (including nicknames and birth surnames), sex, whether they are alive, dates and places of birth and death, a short story, who is whose parent (by birth, adoption, fostering or as a step-parent) and who is whose partner (with the kind of relationship, its dates and how it ended), and, later, identifiers from other family-history services. We have no fields for addresses, phone numbers, ID numbers, health or religion, and we ask members not to put them in stories.

About photos and stories: the photos members add — we remove the location and camera details hidden in a photo's file, and keep a full-quality copy plus smaller copies for the screen (the original file, which no one can open, keeps them until it is deleted 30 days after it was added) — who is tagged on them, captions, the stories members tell (with their dates and who they are about or mention), life events such as moves and jobs, and when a member asks an admin to look at a story or photo. Before anyone can see a photo, it is checked for viruses on our own server.

About how the app is used: the history of every change (who changed what, and when) so a family can undo mistakes; the days each member was active and how many changes they made each day, kept for 90 days, so a family is not locked out when its admins stop using the app (see “When an admin stops visiting”); and for security, the internet address and kind of device of each signed-in session, and short technical records.

Why we keep it

We keep your account details to give you the account you asked for — that is our agreement with you (contract), and it is why you can join from age 13 without a parent's consent. We keep the details of relatives who have no account, the history of changes, the activity days and the security records because we and the families have a legitimate interest in keeping a family's history together, letting families undo mistakes, keeping families from being locked out, and keeping the service safe; you can object at any time (see “Your choices”). We do not rely on your consent, never sell your data, never show advertising and never use it to train AI.

Signing in with Google

If you choose “Continue with Google”, Google tells us your email, that Google has checked it, your name and a number that identifies your Google account. We keep that number and email so you can sign in again. Google does not see your family tree. You can unlink Google from your account settings at any time, as long as you keep another way to sign in.

Invitations

When a member invites a relative, we keep the relative's email to send the invitation and to show it to the family's admins while it waits. An invitation works for 7 days; we delete it 30 days after it is accepted, cancelled or runs out.

Living relatives

Everyone in a tree is treated as living unless a member says otherwise. Everything in a family's tree — names, dates, places, stories and photos — is seen by every member of that family, and only by them. Members who can only view see the same as everyone else; they just cannot change anything. The exceptions: something an admin has hidden is seen only by the admins and whoever shared it, and something recently deleted only by the admins, who can bring it back within 30 days.

Children

You need to be 13 or older to have an account, and 18 or older to look after a family as an admin. Children can be in the tree and in photos without an account. Like everything else in the tree, they are seen only by the members of that family. When you add a child, think about what their parents would be happy to share.

Who else handles your data

Only the members of your family space can see its tree; there are no public links. We use a few services to run Familiagram, each only for its job: our hosting provider (the servers), Resend (sending emails, in the United States), Backblaze B2 (an encrypted copy of our backups) and Google (only if you sign in with Google). Where data leaves New Zealand or the European Union, we put in place the protections the law requires, such as standard contractual clauses; you can ask us for a copy.

How long we keep it

Your account stays until you close it. Someone deleted from a tree can be brought back for 30 days, then they are deleted for good. Links we email you (to check your address or reset your password) stop working within a day and are deleted soon after. The original file of an uploaded photo is deleted 30 days after it was added; the photo itself (its full-quality copy and the smaller copies) stays until someone deletes it, and a deleted photo can be brought back for 30 days before it is deleted for good. Activity days are deleted after 90 days. A download of your data is deleted 7 days after it is ready. Security records keep no names and are deleted after 24 months; our technical logs are kept for 30 to 90 days and our server logs for 14 days. Backups usually clear within about 30 days.

Remove & forget

A family's admins can remove and forget a person. Their name, dates, places and story, and their couples' notes and dates, are deleted, and so is every earlier version of them in the history. They stay in the tree as “Private person”, still linked to their relatives, so the family stays connected — and an admin can then delete that placeholder too. Photos where they are tagged and no one else is are deleted; on other photos their tag and the caption go. Where a story, a bio or an event links to them, the link becomes “a relative” (names typed as plain words are not changed, so the admin is asked to check), and a story only about them is hidden until an admin decides. Their life events and their couples' events are deleted. We keep a record that it happened, without any of the deleted details. Copies in our backups usually disappear within about 30 days; if we ever had to restore a backup, we would remove them again before anyone signs in.

When an admin stops visiting

A family should never be locked out. If a family's only admin, or all of its admins, have not visited for 30 days, the admin role passes to a contributor who has been in the family for at least 30 days and visited in the last 30 days. We choose the most active one from what they did in the last 90 days (how many changes they made, counting at most 20 a day, and on how many days), then who visited last. Admins are emailed a week before, and visiting is enough to keep the role; an admin who comes back within 90 days gets it back. If no one qualifies, the members are told, and a member who qualifies can take the role.

We keep a record of each handover (who, when and why) as long as the family exists, and the candidates' activity scores for 90 days after it.

When a member passes away

An admin can mark a member as having passed away. We email that member: if it is a mistake, signing in within 14 days is enough and nothing changes. After 14 days their account is closed (no one can sign in to it), their place in the tree is protected, and what they added stays in the family's memory. An admin can undo this.

The family's history

Every member can see the family's activity: who added or changed what in the tree, and when. Admins can also see the family's admin log (who joined, role changes, removals and similar events) with members' names; every other member sees only their own entries there. These records keep no names: names are looked up when the page is shown, and someone who has left shows as a former member.

Your choices

You can ask to see what we hold about you, to get your account data in a portable form, to correct it, to delete it, to limit how we use it, or to stop us using it. If you are in someone's tree and do not have an account, you can ask too. Write to us: we will answer within a month and, where the request is about a family's tree, work with that family's admins, who can correct what the tree says about you or remove and forget you. If they do not act on a request we find valid, we can remove and forget you ourselves; the family's admins are then told that Familiagram did it after a privacy request. You can also do two of these yourself, on your account page. “Download my data” gives you a copy of your account details and of everything you added or changed in your families, including the photos you uploaded; we tell you when it is ready and it stays available for 7 days. “Delete my account” removes your email, password, name and sign-ins; what you added to your families stays for them, shown as from a former member, and your own place in the tree stays unless you ask us to forget it too. If you are a family's only admin, the role passes on straight away, or the family can choose a new admin. Copies of a deleted account in our backups usually disappear within about 30 days; if we ever had to restore a backup, we would delete it again before anyone signs in.

If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner in New Zealand, or to the data protection authority where you live.

Changes to this notice

If we change this notice in a way that matters, we will tell members in the app before the change applies. The date at the top always shows the current version.